The statutory tort for serious invasions of privacy is now in force

For decades, Australian courts declined to recognise a general right to sue for invasion of privacy. That changed on 10 June 2025, when Schedule 2 of the Privacy Act 1988 commenced. It was inserted by the Privacy and Other Legislation Amendment Act 2024, which received Royal Assent on 10 December 2024. The commencement provision fixed Schedule 2 to start by Proclamation or, failing that, six months after assent.

Schedule 2 creates a cause of action in tort that individuals pursue themselves in court. The OAIC does not administer it, although clause 22 allows the Information Commissioner, with the court’s leave, to intervene or to assist as amicus curiae. Schedule 2 is drafted to be read separately from the rest of the Privacy Act (clauses 2 and 6), so concepts such as “APP entity” and the small business exemption do not limit it.

The five elements

Clause 7(1) gives an individual a cause of action against another person if all of the following are established:

1. An invasion of privacy. The defendant intruded upon the plaintiff’s seclusion, misused information that relates to the plaintiff, or both. Intruding upon seclusion includes physically intruding into a person’s private space and watching, listening to or recording their private activities or affairs. Misusing information includes collecting, using or disclosing information about the individual (clause 6).
2. A reasonable expectation of privacy. A person in the plaintiff’s position would have had a reasonable expectation of privacy in all the circumstances. Clause 7(5) lists matters the court may consider, including the means used (such as any device or technology), the purpose of the invasion, the plaintiff’s age, occupation or cultural background, whether the plaintiff invited publicity, the place of any intrusion, and, for information, its nature (for example health, intimate, family or financial matters), how it was held, and whether it was already public.
3. Intention or recklessness. The invasion was intentional or reckless, with “reckless” carrying its Criminal Code meaning. Negligence is not enough.
4. Seriousness. Under clause 7(6), the court may consider the degree of offence, distress or harm to dignity likely to be caused to a person of ordinary sensibilities, whether the defendant knew or ought to have known that was likely, and, for intentional invasions, whether the defendant was motivated by malice.
5. Public interest balance. The public interest in the plaintiff’s privacy outweighed any countervailing public interest. Clause 7(3) lists examples, including freedom of expression, freedom of the media, the proper administration of government, open justice, public health and safety, national security, and the prevention and detection of crime and fraud.

The invasion is actionable without proof of damage (clause 7(2)). Where the claim concerns misuse of information, it is immaterial whether the information was true (clause 7(7)).

Defences

Clause 8(1) provides defences where the invasion was required or authorised by or under an Australian law or court or tribunal order; where the plaintiff, or someone with lawful authority for them, expressly or impliedly consented; where the defendant reasonably believed the invasion was necessary to prevent or lessen a serious threat to a person’s life, health or safety; and where the invasion was incidental to a lawful right of defence of persons or property and was proportionate, necessary and reasonable.

Where the invasion consists of publishing information, clause 8(2) and (3) import three defamation defences: absolute privilege, publication of public documents, and fair report of proceedings of public concern. A court may decide at any stage whether an exemption applies, and must generally do so before trial if a party applies early (clause 8A).

Exemptions

Part 3 of Schedule 2 removes certain conduct from the tort altogether:

• Journalists (clause 15). The tort does not apply to journalists, their employers and those assisting them, to the extent the invasion involves collecting, preparing or publishing journalistic material, or to the publication of journalistic material prepared by a journalist. A journalist must work professionally as one and be subject to professional standards or a code of practice.
• Government agencies (clauses 16 and 16A). Agencies and State and Territory authorities, and their staff, are exempt where they act in good faith in performing functions or exercising powers.
• Law enforcement bodies and intelligence agencies (clauses 16B and 17). These bodies are exempt, as are disclosures of information to them and the use of information they disclose.
• Persons under 18 (clause 18).

Claims also cannot be brought by or against a deceased person (clause 20).

Remedies and the damages cap

The court may award damages, including for emotional distress, but not aggravated damages. Exemplary or punitive damages are available only in exceptional circumstances (clause 11). The combined total of damages for non-economic loss and any exemplary or punitive damages must not exceed the greater of $478,550 and the maximum amount for non-economic loss in defamation proceedings under an Australian law (clause 11(5)). Economic loss is not subject to that cap.

In setting damages, the court may consider any apology, any correction, compensation already received, settlement efforts, and unreasonable conduct by the defendant after the invasion, including during the proceedings (clause 11(6)). An apology is not an admission of liability (clause 13).

Clause 12 allows other remedies in addition to or instead of damages: an account of profits, an injunction, an order to apologise, a correction order, an order for the destruction or delivery up of material obtained or misused, and a declaration that the defendant seriously invaded the plaintiff’s privacy. Interim injunctions are available at any stage, with particular regard to the public interest where publication is involved (clause 9).

Limitation periods

Under clause 14, proceedings must be commenced before the earlier of one year after the plaintiff became aware of the invasion and three years after it occurred. If the plaintiff was under 18 at the time, the deadline is their 21st birthday. A court may extend time where it was not reasonable to commence within the period, but not beyond six years after the invasion. A single publication rule treats substantially similar republications as occurring on the date of first publication (clause 19).

Who can be sued

The defendant can be any “person”, which includes organisations. Clause 5 extends the tort’s reach through several constitutional heads of power, including invasions by or on behalf of trading, financial and foreign corporations, invasions using telecommunications services, and invasions in the course of interstate or international trade or commerce. Schedule 2 does not displace State or Territory laws (clause 21).

For organisations, the most realistic exposure lies in deliberate choices: covert workplace monitoring, investigations that overreach, customer surveillance, or staff who intentionally access and share information about others. Ordinary compliance with the Australian Privacy Principles does not answer the tort’s questions, which focus on intent, seriousness and the public interest in a particular invasion.

General information, not legal advice. Confirm how the statutory tort applies to your organisation with your legal adviser.